Important Notes
This Patcher updates the Sentry Print Service previously installed by Blueprint 5.5, or by a previous Sentry Print update for Blueprint 5.5. It cannot be applied with earlier or later versions of Blueprint.
It is not able to install a Sentry Print Service on an Analyst or Collector where a Sentry Print Service was never installed as part of Blueprint.
A subsequent upgrade to Blueprint 6.0 or 6.1 will fail unless you first replace the Sentry Print Service in the Blueprint installation media with the version included in this update. The Sentry Print Service delivered here is newer than the version bundled with the Blueprint 6.0 and 6.1 installers, and Windows Installer will not replace a newer product with an older one. See Replacing the Sentry Print Service in the Blueprint installation media for instructions.
Canon, Asia/Pacific/Japan region: Canon devices in the Asia/Pacific/Japan (APJ) region are not certified for this release, and the APJ Licence Access Numbers are not included in it. The APJ Licence Access Numbers apply only to the previous Canon MEAP application (1.1.0.7) and are not valid for the Canon MEAP application shipped here (1.2.0.0); they will be reinstated once Pharos is re-certified by Canon APJ. Customers in the APJ region with Canon devices should NOT apply this update.
Canon, all other regions: This update includes updated Canon certified application files and updated Licence Access Numbers for the CUSA and EMEA regions. Existing secured Canon devices must be resecured after applying this update.
Ricoh: Existing secured Ricoh devices must be resecured after applying this update for the logoff confirmation prompt and Secure Print icon auto-placement changes to take effect.
Lexmark: This update includes updated Lexmark embedded files. Existing secured Lexmark devices must be unsecured and then resecured after applying this update for the embedded file changes, including the TLS connection fix, to take effect.
Lexmark: Lexmark devices running FW3 or FW4 firmware are no longer supported. Customers with FW3 or FW4 Lexmark devices in their fleet should review this before applying this update.
Note: Previous Blueprint 5.5 hotfixes
This version of the Sentry Print Service includes the changes from all previous Blueprint 5.5 Sentry Print hotfixes and patches. If you have applied an earlier Blueprint 5.5 Sentry Print update, including a customer-specific hotfix, those changes are carried forward in this release and you do not need to reapply them.
The component included in this update is:
Component | Version | MSI Version |
|---|---|---|
Sentry Print Service | 2610.607.346 | 26.10.9063.0 |
Note: Due to changes in the component versioning and limitations in MSI versioning, the Sentry Print Service now has two version numbers. The MSI version number is the one that will show in Window's "Add and Remove Programs".
What is new in 5.5 - Sentry Print 2610.607.346
The following list covers every change to the Sentry Print Service since the version released with Blueprint 5.5. Changes are listed from newest to oldest. If you have already applied an earlier Blueprint 5.5 Sentry Print update, some of these changes will already be present on your servers.
Print All screen shown instead of Review Documents after logging on to an HP device - On HP terminals configured to use Review Documents as the home screen, users were taken to the Print All screen after logging on instead of Review Documents. The correct home screen is now shown.
Swiping an unregistered card on a Lexmark device did not start card registration - Swiping an unregistered proximity card on a Lexmark device failed rather than starting the card registration workflow. Card registration now starts as expected, subject to the usual card registration settings.
Custom user name label overflowed on small screen devices - A custom logon label, for example "Standard ID", wrapped above the input field on small screen devices. The label now remains correctly aligned with the input field.
No visual feedback during card authentication on HP devices - A loading indicator is now displayed while a successful HP card swipe is being processed, giving users feedback between swiping their card and the application home screen appearing.
Badge reader not recovering after an application reload or device Reset on HP devices - Card reader registration recovery at startup has been corrected so the badge reader is reinitialised reliably after an application reload or a device Reset.
Standardized application name, icon and publisher on Windows - The Sentry Print Service now appears as "Pharos Sentry Print" with the Pharos Torch icon and a publisher of "Pharos Systems International" in Control Panel, the Start Menu, and Settings > Installed Apps. The underlying Windows service name is unchanged.
Missing Sentry Print certificate on Konica Minolta devices - Where Certificate Verification was enabled, the MFP displayed a certificate verification prompt followed by a blank white screen instead of the Secure Print logon page, because the Sentry Print certificate had not been installed on the device during provisioning. The certificate is now installed correctly during provisioning.
Logoff confirmation prompt control on Ricoh devices - The logoff confirmation prompt on Ricoh IM devices has been removed. Users are no longer presented with an unnecessary extra step when logging off the device.
Secure Print icon auto-placement on Ricoh devices - The Secure Print app icon is now automatically placed on the device home screen after securing. Previously, the icon was hidden in the device apps folder, requiring administrators to manually move it on each device individually, a particularly burdensome task in large-scale deployments.
Faster re-securing of Ricoh devices - Re-securing Ricoh devices has been significantly optimized. The process has been reduced from approximately 15-20 minutes to under 10 minutes per device, improving deployment speed for large-scale fleet updates.
Unable to remove the Pharos Secure Print application from Konica Minolta MFPs with blank administrator passwords - If a Konica Minolta MFP had a blank administrator password, the Pharos application could be registered but could not be removed. Both registration and removal now work correctly regardless of the password configuration.
First card swipe fails to log in the user when a Konica Minolta device has been idle - When a KM device had been idle for a period (logon page no longer displayed, screensaver potentially shown), swiping a proximity card would briefly show a "waiting" screen followed by the logon screen, but the user was not logged in. A second card swipe was required to authenticate. A single card swipe on an idle MFP now logs the user in immediately, as expected.
Control access to third party applications on HP devices - Blueprint now allows administrators to deny access to third party (non native) applications on supported HP MFPs using Policy Print.
Added support for new Canon models- The following Canon devices can now be secured with Pharos Sentry Print for Blueprint
imageRUNNER DX 4935
imageRUNNER DX 6855
imageRUNNER DX C359
imageRUNNER DX C3930
imageRUNNER DX 48xx
imageRUNNER DX C48xx
imageRUNNER DX 49xx
imageRUNNER DX C49xx
CX635
imageCLASS X MF1333C/C1333iF/i
imageForce 6100
Added support for new Lexmark models- The following Lexmark devices can now be secured with Pharos Sentry Print for Blueprint
CX950g
CX950se
CX951g
XC9525
CX951se
Select All button for small screen devices - A new Select All button was added for small screen devices to keep the experience consistent with larger screen devices.
Lexmark devices unable to connect to the Sentry Print Service - Resolved a TLS negotiation issue that prevented Lexmark devices running CXTLS.240.xxx firmware from connecting to a Sentry Print Service hosted on Windows Server 2016 or 2019. This update includes updated Lexmark embedded files; affected printers must be resecured for the fix to take effect.
Secure Print stopping on Ricoh IM C3010 devices - Resolved an issue causing Secure Print to stop on Ricoh IM C3010 model devices.
How to apply this Update
Warning: Blocked Files
Depending on how this update or its files were copied to the target machine, some of the files may have been 'blocked' by Windows. Trying to update a Blueprint component with a blocked file will most likely prevent that component from working correctly. To check whether a file is blocked and/or unblock it, right-click the file in Windows Explorer and select 'Properties'.
Warning: In use Files
Under some conditions, the patcher may be unable to replace files because they are in use. If this happens,
Stop all Application Pools in IIS.
Run the upgrade again.
Start all Application Pools after the patcher succeeds.
Updating Analyst or Collector
Installation Steps
Close the Window's Printers window (if it is open). Close any Pharos applications (e.g. Troubleshooter, Blueprint Administrator) that are open.
Note: you do not need to stop the Pharos Services. The patcher will do this automatically.Open an elevated Windows command prompt and run SentryPatcher.exefrom the command line. No additional parameters are necessary.
The patcher does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the patcher. This output will include error messages if the patcher fails.
If the patcher fails, you can correct the cause of the error and run SentryPatcher.exe again.
At completion, the Patcher may automatically force a restart. Follow the remaining instructions after the restart.
To log the installation of MSI files associated with the update, edit <MsiLogFileDirectory> in the SentryPatcher.xml file with a folder path.
To reinstall a Sentry Print Service on Analyst or Collector where a Sentry Print service was installed as part of Blueprint and then manually uninstalled.
Use same steps as above.
Replacing the Sentry Print Service in the Blueprint installation media
The Sentry Print Service included in this update, MSI version 26.10.9063.0, is newer than the Sentry Print Service bundled with the Blueprint 6.0 and 6.1 installers. Windows Installer will not replace a newer product with an older one, so a later upgrade to Blueprint 6.0 or 6.1 will fail when Setup reaches the Sentry Print Service.
Before upgrading an Analyst or Collector that has had this update applied, replace the Sentry Print Service in the Blueprint installation media as follows.
Take a writable copy of the Blueprint 6.0 or 6.1 installation media. Do not attempt to edit the media in place if it is held on read-only storage.
From this update, copy the following two files from the Integrations\PharosMfpSiteServicefolder:
Mps.Client.Mfp.Install.msi
featureflags.json
In your copy of the Blueprint installation media, paste both files into the Integrations\PharosMfpSiteService folder, overwriting the existing files of the same name.
Check that neither pasted file has been blocked by Windows. Right-click each file in Windows Explorer, select 'Properties', and click 'Unblock' if the option is present.
Run Setup.exe from your modified copy of the installation media to perform the upgrade.
After the upgrade completes, confirm in Window's "Add and Remove Programs" that the Sentry Print Service MSI version is 26.10.9063.0 or later.
Note
This applies to every Analyst and Collector on which this update has been applied. Any server still running the Sentry Print Service version originally supplied with Blueprint 5.5 can be upgraded with unmodified installation media.
Automated Server Deployment
Customers with a large number of Blueprint Servers may want to deploy this update using an automated software deployment tool (e.g. IBM's Tivoli).
To help with this process, the Patcher can be configured to send an e-mail at the end of the patching process indicating the patching attempt's success or failure. The configuration is held in the file SentryPatcher.xml. Modify the file as follows:
Change the <automated> element from "false" to "true".
Set "to" to the e-mail address you want the notification sent to.
Set "from" to the e-mail address you want the notification to claim it was sent from.
Set smtpServerHost to the FQDN of the mail server.
Leave smtpServerPort alone, unless the mail server is using a non-standard port. Or you want the communication encrypted using SSL.
If the mail server and its Host are configured to support SSL, you can change useSSL to "true" and smtpServerPort to the SSL port (usually 465).
Set smtpUserName and smtpPassword to the user and password needed to use the mail server.
If you do not want to put an unencrypted password in the SentryPatcher.xml file, you can put the password as encrypted text into smtpEncryptedPassword. You can encrypt the password by calling SentryPatcher.exe from the command line with the flag "/encrypt:". e.g. Assume your mail server's password is "MySecretPassword".
Open an elevated command prompt and type in patcher /encrypt:MySecretPassword
SentryPatcher.exe will return EncryptedPassword:L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"
Set smtpEncryptedPassword="L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"
If your deployment tool will run the patcher under an account that has permission to send e-mails, then you can set useDefaultCredentials to "true" and leave smtpUserName, smtpEncryptedPassword and smtpPassword blank.